Adobe ColdFusion 10
Adobe ColdFusion 10
The Adobe ColdFusion 10 reached end of service life on May 16, 2019 — Adobe ColdFusion no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Adobe ColdFusion 10 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- coldfusion
- release
- 10
- product Label
- Adobe ColdFusion
- release Label
- 10
- codename
- lts
- latest Version
- 10.0.23.302580
- release Date
- 2012-05-15
- maintained
- source Url
- https://endoflife.date/coldfusion
Lifecycle Dates
- End of Service Life
- May 16, 2019
- Last OEM Support
- May 16, 2017
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Adobe ColdFusion 10 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Adobe ColdFusion 10?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Adobe ColdFusion 10 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Adobe ColdFusion 10 Support: Frequently Asked Questions
Is the Adobe ColdFusion 10 still supported?
Adobe ColdFusion ended support for the Adobe ColdFusion 10 on May 16, 2019 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Adobe ColdFusion 10 end of service life (EOSL) date?
Adobe ColdFusion lists the end of service life for the Adobe ColdFusion 10 as May 16, 2019.
Can I keep using the Adobe ColdFusion 10 after its EOSL date?
Yes. EOSL means Adobe ColdFusion stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Adobe ColdFusion 10 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Adobe ColdFusion 10
37 published CVEs affect the Adobe ColdFusion 10, including 17 rated critical or high severity. Adobe ColdFusion no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-44353 | CRITICAL | 9.8 | Nov 17, 2023 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. |
| CVE-2023-44351 | CRITICAL | 9.8 | Nov 17, 2023 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. |
| CVE-2023-44350 | CRITICAL | 9.8 | Nov 17, 2023 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. |
| CVE-2017-3066 | CRITICAL | 9.8 | Apr 27, 2017 | Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution. |
| CVE-2016-1114 | CRITICAL | 9.8 | May 11, 2016 | Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library. |
| CVE-2013-0632 | CRITICAL | 9.8 | Jan 17, 2013 | administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013. |
| CVE-2013-3350 | HIGH | 10.0 | Jul 10, 2013 | Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets. |
| CVE-2013-1389 | HIGH | 10.0 | May 16, 2013 | Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2016-4264 | HIGH | 8.6 | Sep 1, 2016 | The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2013-5328 | HIGH | 7.8 | Nov 13, 2013 | Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2023-26347 | HIGH | 7.5 | Nov 17, 2023 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction. |
| CVE-2013-1387 | HIGH | 7.5 | Apr 10, 2013 | Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors. |
| CVE-2013-1388 | HIGH | 7.5 | Apr 10, 2013 | Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors. |
| CVE-2013-0629 | HIGH | 7.5 | Jan 9, 2013 | Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013. |
| CVE-2021-40699 | HIGH | 7.4 | Sep 7, 2023 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment. |
| CVE-2021-40698 | HIGH | 7.4 | Sep 7, 2023 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment. |
| CVE-2012-5674 | HIGH | 7.1 | Nov 20, 2012 | Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors. |
| CVE-2014-0570 | MEDIUM | 6.8 | Oct 15, 2014 | Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2023-44352 | MEDIUM | 6.1 | Nov 17, 2023 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. |
| CVE-2022-28818 | MEDIUM | 6.1 | May 12, 2022 | ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. |
Showing the 20 most severe of 37 known CVEs.
Get Third Party Support